Fix Duplicate Device IDs on VDI clones in VMware Carbon Black Cloud – Red Canary help

Issue

I am unable to see my endpoints in the VMware Carbon Black Cloud Console. However, I can see multiple endpoints in Red Canary associated with the same device ID. Is there a way that I can remedy this issue?

Environment

VMware Carbon Black Cloud; VDI clones

Resolution

Use RepCLI to force cloned VDI sensors to obtain a new device ID.

WARNING: The "reregister" command should only be run on cloned images because it will register the Sensor as a clone with the backend and VDI deregistration rules will apply.

Log into the machine with a user account that matches the AD User or Group SID configured at the time of sensor install.
Open a command prompt and navigate to C:\Program Files\Confer
Enter the "repcli reregister now" command

C:\Program Files\Confer> repcli reregister now
Successfully scheduled re-registration

C:\Program Files\Confer>

Note: If the sensors were deployed via SCCM or GPO, the above command can be deployed via a script to the affected endpoints.

Check the VMware Carbon Black Cloud Console to verify that the Sensor has updated the Device ID (Endpoints > Search by hostname)

Cause

Duplicate device ID assignments can be caused due to a misconfigured base image where the sensor was not installed using the VDI=1 or BASE_IMAGE=1 parameters. If the parameters are missing, it may result in the clones subsequently checking into the backed and being recognized as the same device.